MISP / MISP/misp-modules

Crowdstrike_falcon error: "Cannot save log because of validation errors:...

Open
#386 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
377
Forks
280
Avg merge
2d 2h
Merged PRs (30d)
10

Description

OS: Ubuntu 18.04
MISP: v2.4.123 (55bcc4fa470af0bd24db0128e3b2cf3919af1c7e)

This was, originally, #5710 in the MISP issues but I am opening it, here, instead. I am getting the following errors when I try to test the crowdstrike_falcon module using CURL. The credentials are ok and the data are in Crowdstrike but what is returned is an empty array:

[2020-03-24 10:20:27] main.INFO: got {"queue":"prio","id":"7f08bee11f3c977af36cb1e9b5c238a0","class":"EventShell","args":[["enrichment","2","1393","["crowdstrike_falcon"]","1487"]]} {"type":"got","args":"[object] (Resque_Job: {"queue":"prio","id":"7f08bee11f3c977af36cb1e9b5c238a0","class":"EventShell","args":[["enrichment","2","1393","[\"crowdstrike_falcon\"]","1487"]]})","worker":"XXXX:4333"} []
[2020-03-24 10:20:27] main.INFO: Processing ID:7f08bee11f3c977af36cb1e9b5c238a0 in prio {"type":"process","worker":"XXXX:4333","job_id":"7f08bee11f3c977af36cb1e9b5c238a0"} []
[2020-03-24 10:20:29] main.ERROR: {"queue":"prio","id":"7f08bee11f3c977af36cb1e9b5c238a0","class":"EventShell","args":[["enrichment","2","1393","["crowdstrike_falcon"]","1487"]]} failed: Cannot save log because of validation errors: {"action":["Options : ..."]} {"type":"fail","log":"Cannot save log because of validation errors: {"action":["Options : ..."]}","job_id":"7f08bee11f3c977af36cb1e9b5c238a0","time":1776,"worker":"XXXX:4333"} []

I re-installed MISP Modules but it had no effect. It may be affecting other Enrichments besides Crowdstrikes. I haven't tested. Also, this instance was installed using the Ubunto 18.04 INSTALL script.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the crowdstrike_falcon enrichment request with CURL on the reported MISP v2.4.123 and Ubuntu 18.04 setup, then inspect the logged EventShell job and the validation error for the action field. Compare the empty CrowdStrike response with the failing log creation; done means the enrichment completes without the validation error and returns the expected data.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.